MD5 vs SHA-1 vs SHA-256: Hashing Algorithms Compared

Cryptographic hash functions are the backbone of modern security. They power everything from password storage to blockchain consensus to software distribution verification. But with multiple algorithms available — MD5, SHA-1, SHA-256, SHA-512, SHA-3 — choosing the right one matters. A poor choice can leave your application vulnerable to real-world attacks.

What Are Cryptographic Hash Functions?

A cryptographic hash function takes an arbitrary-length input and produces a fixed-length output (the "digest"). A good hash function satisfies five key properties:

Deterministic: The same input always produces the same output. No randomness involved.
Fixed output size: Whether you hash 1 byte or 1 terabyte, the digest length is always the same.
Avalanche effect: Changing a single bit in the input should change roughly 50% of the output bits.
Pre-image resistance: Given a hash output, it should be computationally infeasible to find the original input.
Collision resistance: It should be computationally infeasible to find two different inputs that produce the same hash.

MD5 (Message Digest 5)

128-bit outputBROKENPublished 1992

Designed by Ronald Rivest in 1992, MD5 produces a 128-bit (16-byte) hash, typically rendered as a 32-character hex string. For years it was the go-to hash function, but its security has been thoroughly compromised.

MD5("hello") =
5d41402abc4b2a76b9719d911017c592

In 2004, researchers demonstrated practical collision attacks against MD5. By 2008, a team created a rogue CA certificate using MD5 collisions, proving real-world exploitability. Today, collisions can be generated in seconds on consumer hardware.

When MD5 is still acceptable:

Non-security checksums (verifying download integrity when a secure channel already exists)
Hash table key distribution
De-duplication of non-adversarial content
Legacy system compatibility

Never use MD5 for: passwords, digital signatures, certificates, or anything security-sensitive.

SHA-1 (Secure Hash Algorithm 1)

160-bit outputDEPRECATEDPublished 1995

SHA-1 produces a 160-bit (20-byte) digest. It was the standard hash for SSL certificates, Git commits, and many other systems for nearly two decades.

SHA-1("hello") =
aaf4c61ddcc5e8a2dabede0f3b482cd9aea9434d

The turning point came in 2017 with the SHAttered attack, where Google and CWI Amsterdam produced two different PDF files with the same SHA-1 hash. The attack required approximately 2⁶³ SHA-1 computations — enormous, but well within reach of nation-state actors and cloud computing budgets.

Deprecation timeline:

2017: Major browsers stopped trusting SHA-1 certificates
2020: NIST formally deprecated SHA-1 for digital signatures
Git: Transitioning to SHA-256 (object format v2)

SHA-256 (SHA-2 Family)

256-bit outputCURRENT STANDARDPublished 2001

SHA-256 is part of the SHA-2 family designed by the NSA and published by NIST. It produces a 256-bit (32-byte) digest and is the workhorse of modern cryptography. It powers TLS certificates, Bitcoin mining, code signing, and countless other applications.

SHA-256("hello") =
2cf24dba5fb0a30e26e83b2ac5b9e29e
1b161e5c1fa7425e73043362938b9824

No practical attacks exist against SHA-256. Theoretical collision resistance is 2¹²⁸ operations, which remains far beyond the reach of any foreseeable computing technology including quantum computers (Grover's algorithm would reduce this to 2¹²⁸ for pre-image, still infeasible).

SHA-512: When to Prefer Over SHA-256

SHA-512 is SHA-256's bigger sibling, producing a 512-bit (64-byte) digest. While both are in the SHA-2 family, SHA-512 has some surprising advantages:

Faster on 64-bit processors: SHA-512 uses 64-bit arithmetic internally, making it faster than SHA-256 on modern 64-bit CPUs. Benchmarks often show SHA-512 being 30-50% faster.
Larger security margin: 256-bit collision resistance vs SHA-256's 128-bit.
SHA-512/256 truncation: You can use SHA-512 internally but truncate to 256 bits, getting SHA-512's speed with SHA-256's output size.

Prefer SHA-512 when processing large files on 64-bit systems, or when you need the extra security margin for long-lived data.

SHA-3 (Keccak): The Newest Standard

SHA-3 was standardized by NIST in 2015 after a public competition won by the Keccak algorithm. Unlike SHA-2 (which uses the Merkle-Damgård construction), SHA-3 uses a sponge construction, making it structurally different and resistant to any future attack that might target SHA-2's design.

SHA-3 is not a replacement for SHA-2 — rather, it's an insurance policy. If a weakness is ever found in SHA-2's construction, SHA-3 provides a ready alternative. In practice, SHA-256 remains the default choice for most applications. SHA-3 sees use in some blockchain protocols (Ethereum uses Keccak-256) and in systems that require algorithm diversity.

Algorithm Comparison

Algorithm	Output	Speed	Security	Common Uses
MD5	128-bit	Very fast	Broken	Legacy checksums
SHA-1	160-bit	Fast	Deprecated	Git (transitioning)
SHA-256	256-bit	Fast	Secure	TLS, Bitcoin, signing
SHA-512	512-bit	Fast (64-bit)	Secure	Large files, Ed25519
SHA-3	Variable	Moderate	Secure	Ethereum, diversity

Password Hashing: Why Raw SHA-256 Is NOT Enough

This is one of the most critical misunderstandings in security. General-purpose hash functions like SHA-256 are designed to be fast. That's exactly what you don't want for passwords. A modern GPU can compute billions of SHA-256 hashes per second, making brute-force and dictionary attacks trivial.

Never do this:

hash = SHA256(password) // Crackable in seconds

Instead, use a purpose-built password hashing function that is intentionally slow and memory-intensive:

Argon2id (Recommended)

Winner of the 2015 Password Hashing Competition. Configurable time, memory, and parallelism parameters. Resistant to GPU and ASIC attacks. The current best practice.

bcrypt

Battle-tested since 1999. Uses a cost factor to control iterations. Limited to 72 bytes of input. Still widely used and considered secure with a high enough cost factor (12+).

scrypt

Memory-hard function that makes GPU attacks expensive. Used by some cryptocurrency systems. Good choice when Argon2 is not available.

Real-World Applications

File Integrity

Software distributors publish SHA-256 checksums alongside downloads. After downloading, you hash the file locally and compare digests to verify the file wasn't tampered with in transit.

Digital Signatures

Rather than signing an entire document (slow), you hash the document with SHA-256 and sign the 32-byte digest. The recipient hashes the document independently and verifies the signature against their hash.

Blockchain

Bitcoin uses double SHA-256 (SHA-256 applied twice) for block hashing and proof-of-work. Ethereum uses Keccak-256 (a SHA-3 variant). Hash chains create the immutable ledger structure.

HMAC

HMAC-SHA256 combines a secret key with SHA-256 to create a message authentication code. Used in JWTs, API authentication, webhook verification, and any scenario requiring both integrity and authenticity.

Content Addressing

Systems like Git, IPFS, and Docker use content hashes as addresses. The hash of the content IS the identifier. If the content changes, the address changes, guaranteeing immutability.

Subresource Integrity

Browsers can verify that CDN-served scripts haven't been tampered with using SRI hashes in the integrity attribute of script tags.

Choosing the Right Algorithm

Are you hashing passwords?

Use Argon2id or bcrypt. Never use a raw hash function.

Do you need to verify file integrity or sign data?

Use SHA-256. It's the universal default for security-sensitive hashing.

Are you hashing large files on a 64-bit system?

Consider SHA-512 for better throughput, or SHA-512/256 if you need a 256-bit output.

Do you need algorithm diversity (defense in depth)?

Use SHA-3 (Keccak) alongside SHA-2. Its different internal structure provides a hedge.

Do you just need a fast non-security checksum?

MD5 or even CRC32 is fine for non-adversarial integrity checks, hash tables, and de-duplication.

Do you need HMAC for API authentication?

Use HMAC-SHA256. It's the standard for JWTs, webhook signatures, and API request signing.

Hash Any String Instantly

Try our free hash generator — supports MD5, SHA-1, SHA-256, SHA-512, and more with real-time output and copy-to-clipboard.

Try it in DevPop →